What is the CVSS score of CVE-2026-47865?

CVE-2026-47865 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Avi Load Balancer are affected by CVE-2026-47865?

VMware Avi Load Balancer versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2 contain a critical authentication bypass (CVSS 9.8) that allows unauthenticated network-adjacent attackers to gain…

How to fix or mitigate CVE-2026-47865?

Within 24 hours: inventory all deployed VMware Avi Load Balancers and identify instances running versions 22.1.1-22.1.7, 30.1.1-30.2.6, or 31.1.1-31.2.2; segment these by criticality and external network exposure. Within 7 days: implement Layer 3 firewall rules restricting access to Avi Controller management ports (22, 443) to only authorized administrator networks and jump hosts; enable detailed audit logging on all controller API calls and authentication attempts; scan historical logs for signs of unauthorized access or exploitation. Within 30 days: monitor VMware/Broadcom security bulletins for a released patch; develop a staged upgrade plan with roll-out windows; if patch timeline extends beyond organizational risk tolerance, evaluate failover to alternative load-balancing platforms or temporary removal of external-facing Avi instances from production.

Avi Load Balancer CVE-2026-47865

EUVD-2026-45360 CRITICAL

Improper Authentication (CWE-287)

2026-07-18 vmware

GHSA-g2gr-xhcw-h7mc

VMware Authentication Bypass Avi Load Balancer

9.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 09:31 vuln.today

CVE Published

Jul 18, 2026 - 08:57 cve.org

CRITICAL 9.8

DescriptionCVE.org

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Articles & Coverage 2

News 7 New VMware Vulnerabilities - 1 Critical, 6 High Severity Jul 19, 2026 News Critical Authentication Bypass in VMware Avi Load Balancer - CVE-2026-47865 Jul 18, 2026

AnalysisAI

Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: inventory all deployed VMware Avi Load Balancers and identify instances running versions 22.1.1-22.1.7, 30.1.1-30.2.6, or 31.1.1-31.2.2; segment these by criticality and external network exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.